California Edges Closer To Regulating Automated Decision-Making Technology Using Personal Information

The board of the California Privacy Protection Agency (the Agency) recently met to discuss the Agency's draft regulations on automated decision-making technology (ADMT), which will implement provisions of the California Privacy Rights Act amendments to the California Consumer Privacy Act (CCPA). The meeting marked an important step toward adoption of the regulations (Draft ADMT Rules); the next step is the formal rulemaking process, which is expected to commence in early 2024.

The ADMT regulations will place significant limitations on the use of personal information of California residents (Consumers) for automated decision-making by businesses subject to the CCPA (Businesses). "Consumers" in this context include not only individual customers of a Business, but also a Business' employees, job applicants, and business-to-business contacts. As currently drafted, the rules would, in certain contexts (1) require Businesses to notify Consumers prior to applying ADMT to